Basel III final and CRR III: implementation workload for legal, risk and compliance

Short answer: Basel III final has applied in the EU through CRR III (Regulation (EU) 2024/1623) since 1 January 2025, and in Switzerland through the revised Capital Adequacy Ordinance, also since 1 January 2025. Implementation continues: the EU output floor rises each year until 2029, the new market risk rules apply from 1 January 2027, and CRD VI brings new rules for third-country banks from 2027.

This article is for general counsel, heads of compliance, chief risk officers and regulatory leads at banks and securities firms in Switzerland and Germany. It explains what Basel III final covers, which deadlines apply and what Basel III final implementation means for legal, risk and compliance teams.

What are Basel III final and CRR III about?

Basel III final is the concluding package of capital reforms from the Basel Committee on Banking Supervision. In the EU, two acts implement it:

• CRR III (Regulation (EU) 2024/1623): amends the Capital Requirements Regulation (EU) No 575/2013 and applies directly. According to its title, it covers credit risk, credit valuation adjustment (CVA) risk, operational risk, market risk and the output floor.
• CRD VI (Directive (EU) 2024/1619): amends the Capital Requirements Directive 2013/36/EU on supervisory powers, sanctions, third-country branches and ESG risks. It has to be transposed into national law.

The core is the output floor: banks using internal models may not push their risk-weighted assets below a set limit. The floor ultimately stands at 72.5% of the own funds requirements that would apply under the standardised approaches (recital 5 of CRR III); until the end of 2029, a rising transitional factor applies (Art. 465(1) CRR).

In Switzerland, the Federal Council implemented Basel III final by amending the Capital Adequacy Ordinance (CAO/ERV). FINMA issued five new ordinances, covering credit risks, market risks, leverage ratio and operational risks, eligible capital and disclosure. They replace several former FINMA circulars.

Who is affected?

Banks and securities firms in both countries are affected, to a different extent depending on their business model. Institutions with internal models, a large trading book or cross-border business face the most work.

Exemptions from the branch requirement apply, among others, where a client approaches the third-country undertaking at its own exclusive initiative, to services for credit institutions and within the same group (Art. 21c(2) CRD). Investment services under MiFID II are not covered (Art. 21c(4) CRD).

Deadlines and status

Most rules already apply; several important dates fall in 2027.

On market risk, the European Commission adopted a further delegated regulation on 4 June 2026. It provides for temporary adjustments and a multiplier intended to apply for three years from 1 January 2027, provided the Parliament and the Council raise no objection. Check the current status in the Official Journal before any planning.

What banks need to do now

In 2026, banks should complete the outstanding work from the first implementation wave and prepare for the 2027 dates. Typical workstreams are:

1. Update the gap analysis: record differences between the implementation and the final rules, especially for market risk and transitional provisions.
2. Update policies and processes: bring risk methods, data flows, internal controls and responsibilities up to date.
3. Review disclosure and reporting: align content, sign-off processes and controls with the new requirements.
4. Review cross-border business: Swiss institutions with EU clients should establish whether Art. 21c CRD applies, which exemption holds and whether a branch is needed.
5. Update contracts and documentation: align client agreements, collateral and netting documentation and intra-group agreements with the new rules.
6. Evidence governance: document decisions, assumptions and controls so that the audit firm and the supervisor can follow them.

Which roles and capacity are needed

Implementation mainly needs regulatory, risk and compliance specialists, supported by lawyers for contracts and third-country questions. Risk and finance do the calculations; legal and compliance own interpretation, policies and documentation.

How interim support helps

Interim professionals cover the peaks Basel III final creates alongside day-to-day work, without adding permanent headcount. Alpinum Solutions provides regulatory, risk, compliance and legal professionals via staff leasing or freelancing, part-time or full-time, individually or as a team. The bank directs the assignment: under staff leasing, the client holds the right to give professional instructions and the professional is integrated into the organisation. Responsibility for capital calculations, choice of methods and reporting stays with the bank.

Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together. Our guide to interim legal & compliance for banks shows which other projects banks staff on a temporary basis. For an overview of supervisory requirements in Switzerland, see FINMA circulars at a glance.

Frequently asked questions about Basel III final implementation

Does CRR III apply to Swiss banks?

Not directly. Banks in Switzerland are subject to the revised Capital Adequacy Ordinance and the FINMA ordinances, in force since 1 January 2025. CRR III does affect Swiss groups through their EU subsidiary banks. In addition, CRD VI can catch Swiss institutions that provide banking services to clients in the EU (Art. 21c).

What is the output floor?

The output floor is a lower limit on the risk-weighted assets of banks using internal models. It prevents internal models from reducing capital requirements too far. In the EU, the factor rises from 50% in 2025 by five percentage points a year to 70% in 2029 (Art. 465(1) CRR); the target value is 72.5%.

When do the new market risk rules apply?

In the EU, from 1 January 2027. Until then, institutions continue to apply the previous market risk rules (Art. 520a CRR as amended by Delegated Regulation (EU) 2025/1496). In June 2026, the Commission also adopted temporary adjustments for three years from 2027, which were still subject to scrutiny by the Parliament and the Council.

Do Swiss banks need an EU branch because of CRD VI?

It depends on the business. From 11 January 2027, Art. 21c CRD in principle requires a branch for certain banking services to EU clients. Exemptions apply, among others, where the client acts at its own exclusive initiative, to services for credit institutions and within the group. Assessing this by market and product is one of the most important legal tasks of the coming months.

How much capacity does implementation need?

That depends on size, business model and progress so far. Larger institutions with internal models and a trading book often need a team of regulatory, risk and legal professionals. For smaller banks, one experienced part-time professional who updates the gap analysis, policies and documentation is sometimes enough.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides regulatory, risk and compliance professionals for Basel III projects. Tell us what you need, and we will show you suitable profiles.

• Risk management, internal controls and governance: interim professionals
• FINMA circulars at a glance
• Regulatory calendar for legal & compliance
• Regulatory radar: all articles on regulatory change
• Discuss your needs

Last updated: 10 November 2026.